UbuntuUpdates.org

Package "expat"

Name: expat

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • XML parsing C library - runtime library
  • XML parsing C library - development kit
Latest version: 2.4.7-1ubuntu0.9
Release: jammy (22.04)
Level: updates
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "expat" in Jammy

Repository Area Version
base main 2.4.7-1
base universe 2.4.7-1
security main 2.4.7-1ubuntu0.9
security universe 2.4.7-1ubuntu0.9
updates universe 2.4.7-1ubuntu0.9

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.4.7-1ubuntu0.9 2026-09-24 18:07:22 UTC

expat (2.4.7-1ubuntu0.9) jammy-security; urgency=medium

  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56410-1.patch: xmlwf: protect resolveSystemId from
      integer overflow in expat/xmlwf/xmlfile.c.
    - debian/patches/CVE-2026-56410-2.patch: xmlwf: guard each operator in
      resolveSystemId length sum in expat/xmlwf/xmlfile.c.
    - CVE-2026-56410
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56406.patch: lib: Copy overflow check from
      `XML_Parse` to `XML_ParseBuffer` in expat/lib/xmlparse.c.
    - CVE-2026-56406
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56409.patch: xmlwf: protect output path join from
      integer overflow in expat/xmlwf/xmlwf.c.
    - CVE-2026-56409
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56407.patch: cap entity textLen against signed
      integer overflow in expat/lib/xmlparse.c.
    - CVE-2026-56407
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56411.patch: xmlwf: protect notation list
      allocation from integer overflow in expat/xmlwf/xmlwf.c.
    - CVE-2026-56411
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-56131.patch: lib: protect XML_ResumeParser from
      being called from a handler in expat/lib/xmlparse.c,
      expat/tests/runtests.c.
    - CVE-2026-56131
  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2026-56132-pre1.patch: lib: swap '(size_t)(-1)' for C99
      equivalent, 'SIZE_MAX' in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-pre2.patch: lib: use a `size_t` for group
      sizes in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-1.patch: lib: Remove reuse of `m_groupSize`
      to count `m_scaffIndex` allocation in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-2.patch: lib: doProlog: Fix out-of-bound
      scaffolding index store in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-3.patch: tests: Add a test case for
      scaffolding array limits in shared DTDs in expat/tests/runtests.c.
    - debian/patches/CVE-2026-56132-4.patch: lib: Remove unnecessary
      `scaffIndex` expansion in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-5.patch: lib: Remove indented scoping of
      `new_connector` local in expat/lib/xmlparse.c.
    - CVE-2026-56132
  * SECURITY UPDATE: out-of-bounds read
    - debian/patches/CVE-2026-72522-1.patch: lib: Improve in-code comment for
      functions *toUtf16 in expat/lib/xmltok.c.
    - debian/patches/CVE-2026-72522-2.patch: lib: Stop functions *_toUtf16 from
      mis-classifying low surrogates as high surrogates in expat/lib/xmltok.c.
    - debian/patches/CVE-2026-72522-3.patch: tests/misc_tests.c: Cover Unicode
      surrogate mix-up in expat/tests/runtests.c.
    - debian/patches/CVE-2026-72522-4.patch: lib: Make an exit condition in
      `storeAttributeValue` more defensive in expat/lib/xmlparse.c.
    - CVE-2026-72522
  * SECURITY UPDATE: denial of service (algorithmic complexity of storeAtts())
    - debian/patches/CVE-2026-66046.patch: - lib: Rename hash table `defaultAttsNames` to
      `defaultAttForName` in expat/lib/xmlparse.c. - lib: Migrate .isCdata
      lookup from a linear loop to a hash table lookup in
      expat/lib/xmlparse.c
    - CVE-2026-66046
  * SECURITY UPDATE: out-of-bounds read
    - debian/patches/CVE-2026-76641.patch: lib: Fix out-of-bounds read from hash
      table entries created by dtdCopy in expat/lib/xmlparse.c,
      expat/tests/runtests.c.
    - CVE-2026-76641
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-76957-1.patch: Protect custom encoding callbacks
      from parser reentry in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-76957-2.patch: Test custom encoding callback
      reentry protection in expat/tests/runtests.c.
    - CVE-2026-76957

 -- Isabel Garcia Contreras Tue, 22 Sep 2026 08:18:50 -0400
Source diff to previous version
CVE-2026-56410 xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56406 libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56409 xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-56407 libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56411 xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56131 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a us
CVE-2026-56132 In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled w
CVE-2026-72522 libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Uni
CVE-2026-66046 Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c,
CVE-2026-76641 Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external e
CVE-2026-76957 libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CV

Version: 2.4.7-1ubuntu0.8 2026-09-21 19:07:38 UTC

expat (2.4.7-1ubuntu0.8) jammy-security; urgency=medium

  * SECURITY UPDATE: NULL function-pointer dereference
    - debian/patches/CVE-2026-32776.patch: Fix NULL function-pointer dereference
      for empty external parameter entities in expat/lib/xmlparse.c,
      expat/tests/runtests.c.
    - CVE-2026-32776
  * SECURITY UPDATE: infinite loop while parsing DTD content
    - debian/patches/CVE-2026-32777-1.patch: lib: Reject XML_TOK_INSTANCE_START
      infinite loop in entityValueProcessor in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32777-2.patch: misc_tests.c: Cover
      XML_TOK_INSTANCE_START infinite loop case in expat/tests/runtests.c.
    - CVE-2026-32777
  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2026-32778-1.patch: copy prefix name to pool before
      lookup in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32778-2.patch: test that we do not end up with a
      zombie PREFIX in the pool in expat/tests/runtests.c.
    - CVE-2026-32778
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56408.patch: lib: Waterproof `copyString` from
      integer overflow in expat/lib/xmlparse.c.
    - CVE-2026-56408
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56403-pre1.patch: Replace the empty for-loops with
      while loops in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56403-1.patch: lib: Protect function `storeAtts`
      from signed integer overflow in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56403-2.patch: xmlwf: Protect function `xcsdup`
      from signed integer overflow in expat/xmlwf/xmlwf.c, expat/lib/expat.h.
    - CVE-2026-56403
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-50219-1.patch: lib: Introduce handler call depth
      tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-2.patch: lib: Prepare
      `m_notStandaloneHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-3.patch: lib: Prepare
      `m_externalEntityRefHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-4.patch: lib: Prepare
      `m_unknownEncodingHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-5.patch: lib: Register
      `m_attlistDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-6.patch: lib: Register
      `m_characterDataHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-7.patch: lib: Register `m_commentHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-8.patch: lib: Register `m_defaultHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-9.patch: lib: Register
      `m_elementDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-10.patch: lib: Register
      `m_endCdataSectionHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-11.patch: lib: Register
      `m_endDoctypeDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-12.patch: lib: Register
      `m_endElementHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-13.patch: lib: Register
      `m_endNamespaceDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-14.patch: lib: Register
      `m_entityDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-15.patch: lib: Register
      `m_externalEntityRefHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-16.patch: lib: Register
      `m_notationDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-17.patch: lib: Register
      `m_notStandaloneHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-18.patch: lib: Register
      `m_processingInstructionHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-19.patch: lib: Register
      `m_skippedEntityHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-20.patch: lib: Register
      `m_startCdataSectionHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-21.patch: lib: Register
      `m_startDoctypeDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-22.patch: lib: Register
      `m_startElementHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-23.patch: lib: Register
      `m_startNamespaceDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-24.patch: lib: Register
      `m_unknownEncodingHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-25.patch: lib: Register
      `m_unparsedEntityDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-26.patch: lib: Register `m_xmlDeclHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-27.patch: lib: Protect `XML_GetBuffer` from
      being called from a handler in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-28.patch: lib: Protect `XML_Parse` from
      being called from a handler in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-29.patch: lib: Protect `X
Source diff to previous version
CVE-2026-32776 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-56408 libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-50219 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset fr
CVE-2026-56412 libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within
CVE-2026-56404 libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 libexpat before 2.8.2 has an integer overflow in getAttributeId.

Version: 2.4.7-1ubuntu0.7 2026-02-11 09:08:06 UTC

  expat (2.4.7-1ubuntu0.7) jammy-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2026-24515.patch: updates
      XML_ExternalEntityParserCreate to copy unknown encoding handler user
      data in expat/lib/xmlparse.c.
    - CVE-2026-24515
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-25210*.patch: adds an integer overflow check for
      tag buffer reallocation in the doContent function of
      expat/lib/xmlparse.c.
    - CVE-2026-25210

 -- Ian Constantin <email address hidden> Wed, 04 Feb 2026 17:24:04 +0200
Source diff to previous version
CVE-2026-24515 In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
CVE-2026-25210 In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for t

Version: 2.4.7-1ubuntu0.6 2025-04-08 13:07:46 UTC

  expat (2.4.7-1ubuntu0.6) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service via stack overflow
    - debian/patches/CVE-2024-8176-pre.patch: Remove XML_DTD guards
      before is_param accesses
    - debian/patches/CVE-2024-8176-test-pre-1.patch: minicheck: Add
      fail_unless() macro
    - debian/patches/CVE-2024-8176-test-pre-2.patch: tests: Rename
      _fail_unless to _assert_true for clarity
    - debian/patches/CVE-2024-8176-test-pre-3.patch: minicheck: Add
      simple subtest support
    - debian/patches/CVE-2024-8176-1.patch: Resolve the recursion during
      entity processing to prevent stack overflow
    - debian/patches/CVE-2024-8176-2.patch: Stop updating event pointer
      on exit for reentry
    - CVE-2024-8176

 -- Vyom Yadav <email address hidden> Mon, 07 Apr 2025 20:07:15 +0530
Source diff to previous version
CVE-2024-8176 A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an

Version: 2.4.7-1ubuntu0.5 2024-12-10 02:06:53 UTC

  expat (2.4.7-1ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: denial-of-service via XML_ResumeParser
    - debian/patches/CVE-2024-50602-1.patch: Make function XML_StopParser of
      expat/lib/xmlparse.c refuse to stop/suspend an unstarted parser
    - debian/patches/CVE-2024-50602-2.patch: Add XML_PARSING case to parser
      state in function XML_StopParser of expat/lib/xmlparse.c
    - debian/patches/CVE-2024-50602-3.patch: Add tests for CVE-2024-50602 to
      expat/tests/runtests.c
    - CVE-2024-50602

 -- Nicolas Campuzano Jimenez <email address hidden> Sun, 01 Dec 2024 15:51:42 -0500
CVE-2024-50602 An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an un


About   -   Send Feedback to @ubuntu_updates